21d5cc62e1e9c967f89a944bd62f92f5f952f5e0e6c84b4732ae5167efa106a9

Sharing

Copy URL Twitter E-mail

General

Target
SOLARAUPDATE.zip
Size 24.2MB
Sample240606-pknb8afa55
SHA256 21d5cc62e1e9c967f89a944bd62f92f5f952f5e0e6c84b4732ae5167efa106a9
MD5 0414bce315fab0d72a1b93ccb08a6104
SHA1 122196a612d11c83856ed4c5c2c456d800a705a3
SHA512 bc213459ced075739ceeea30ca07d811f6664aab2fbc6c3dab44a0b70ad21a24ae98ea86caa16aac6b1074d3b6f9fda5f3eee818ee40c21d995d68c3e04d3d13
SSDEEP 393216:3ZoQn1/kODLWk6P6ddxqrYpygY9uiTnqZcdsrc6/mDyAYgWE+8qNUuZysB:311Ruk6PBzHTvWc6/mXYgWDU6ysB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  SOLARAUPDATE.zip
- Size 24.2MB
- SHA256 21d5cc62e1e9c967f89a944bd62f92f5f952f5e0e6c84b4732ae5167efa106a9
- MD5 0414bce315fab0d72a1b93ccb08a6104
- SHA1 122196a612d11c83856ed4c5c2c456d800a705a3
- SHA512 bc213459ced075739ceeea30ca07d811f6664aab2fbc6c3dab44a0b70ad21a24ae98ea86caa16aac6b1074d3b6f9fda5f3eee818ee40c21d995d68c3e04d3d13
- SSDEEP 393216:3ZoQn1/kODLWk6P6ddxqrYpygY9uiTnqZcdsrc6/mDyAYgWE+8qNUuZysB:311Ruk6PBzHTvWc6/mXYgWDU6ysB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  SOLARAUPDATED/SOLARAB.exe
- Size 23.3MB
- SHA256 bdeb7557669f81666d9856ca2e5c72dd74d5c707cfa78fdb6de7dc83c387ee19
- MD5 c4012ff5cd49e7f4352895f89cbaa982
- SHA1 1be267ec4d314cfca7ebd33c530cde5f2e15dac7
- SHA512 2d722420bb6dac751d3d520bfdf1ee6481952f6e3101c23ec2a75ac59ab0810f8a0c97e8595e5a064b92b220d9293b74159e91bca12f4ecc9cb30f2e04f0d2f6
- SSDEEP 393216:8o9DM45CsKh2Jp5M/urEUWj5EnBSVkRIrY87FNwrcf+E6PcZYE9utK+:p9NJKhNdbQzcY87Fycf+8YEWK+
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

upx execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4
- Target
  SOLARAB.pyc
- Size 44KB
- SHA256 b2a3b5f61d94decaa3e4bf6fd9d4836525413b75d9c11370cfbb84a2a89d8d03
- MD5 0b4fbb0e2121e8d85e9e324307b2f186
- SHA1 fc14e82fb8ad20db541a650c8b3f377683079e15
- SHA512 42a8a9cc7d0c3da2188251e5457de364040f2024800b885d9d18cc96d46da447fdcda53090ed925089de7191f206a310b4edd4f0ddf271b63f0ca407fd138485
- SSDEEP 768:n9JWQMr0q6nEPqm0HSmwUqRe8Ie2cxtaaEws4YHE6D9fJOyeWDlhLx3+pJ6y:n9JWh4q6noqmI+1Rr6cxRPeEuTdNDlho
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  SOLARAUPDATED/autoexecute/test.txt
- Size 69B
- SHA256 f7a90e5208841b920b622e0c94eb32653daa297c07d3f8e4abd532201dd5165f
- MD5 8117b088670ace343038cc9e404d5448
- SHA1 b293a8ea46badf3268312b03ffdcbd87936070d2
- SHA512 574acf89b137f2ea2259ec704e76ac04fab40a4166f1b5957fc5701bffbefb25ea8d5e1efadc5a2c7249acd6bde419c759589b37f073b162b25bed29ee677d26
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  SOLARAUPDATED/bin/api-docs.json
- Size 5.9MB
- SHA256 6c003208304e585290c9a655c51e5789c4f3e4241a9abc0139a9dbeb5d2884b1
- MD5 19c541f355cad5fb427a38317479b698
- SHA1 aebc5b3b123ab962606b6072806027d9b6c758e9
- SHA512 78e3cbe554cdf02457a3892033ebd9f74c5b4446e306248594d682918ea5dc6e52cafe72b3bdf59fda1f9f5b3879576ca1ef2d35cebc66f1d55543b618bcf7e5
- SSDEEP 24576:7ccjk1+ox2ptidmo2KtMTdxsuBqXhGz+rM:hiVuBqXhGz+rM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  SOLARAUPDATED/bin/incognito-luau.dll
- Size 1.3MB
- SHA256 8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009
- MD5 157fd035b2a344a94166d7db3756df0e
- SHA1 f221d28c1deb80b4e8d9201226435aefce6b0f75
- SHA512 fad0174fbd22f58dd4fcdaad8378c214270b4faeaca64d9cb306f50e9316072a4c417c5723c4123b8bf94a3dba6ef4e3303ec60f4a2cf0c3a54d8ab375ea717d
- SSDEEP 24576:ZqBSLRktEBl6blwTUMD4zB1VU2bFjYWR0pMQUAqLRAovh4bSAXVVRNRfMXZO:ZqBSLRkt8l6blSU//+2bFfvA1SQVVRNk
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  SOLARAUPDATED/bin/save.json
- Size 46B
- SHA256 1bc3e6bcf3d47756fe6e456ce68165d39ea8358186d1a9bb4b2e5911389b22c1
- MD5 877b13372acbf8bf740694d141d1aeb0
- SHA1 0c764bef8a7c94ef610c129720d3d3d9a66fea3f
- SHA512 38a6a7e7bf9572daeabbafb7bb1868d09f9b487e84e17da263f627315623952ab203c8dc5e940b6d59d15183bdd43d153a08ae421f12d085480e73fcbc3b5b82
- MD5 SHA1 SHA512
Score

3^/10
behavioral13 behavioral14
- Target
  SOLARAUPDATED/scripts/test.lua
- Size 15B
- SHA256 819627eee839b974a3a9905ea4f98b1fce63b9ef68a9a1030b39c52ec2046999
- MD5 45952b4f4540d4ea32b1a56b40dfcb54
- SHA1 c43f61758aede460274cbe0a7a52ed3a8e06201a
- SHA512 5fae4efa4037c96b3012e825e1041ecb419b8b6ce6eeb2f4667228874ddb7be48137d9118dc676e6d1f430e71f68809837e4caea8fd65f6100624e63abb81e8a
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16
- Target
  SOLARAUPDATED/workspace/.tests/appendfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  SOLARAUPDATED/workspace/.tests/getcustomasset.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral19 behavioral20
- Target
  SOLARAUPDATED/workspace/.tests/isfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral21 behavioral22
- Target
  SOLARAUPDATED/workspace/.tests/listfiles/test_1.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  SOLARAUPDATED/workspace/.tests/listfiles/test_2.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  SOLARAUPDATED/workspace/.tests/loadfile.txt
- Size 1B
- SHA256 252f10c83610ebca1a059c0bae8255eba2f95be4d1d7bcfa89d7248a82d9f111
- MD5 8fa14cdd754f91cc6554c9e71929cce7
- SHA1 4a0a19218e082a343a1b17e5333409af9d98f0f5
- SHA512 711c22448e721e5491d8245b49425aa861f1fc4a15287f0735e203799b65cffec50b5abd0fddd91cd643aeb3b530d48f05e258e7e230a94ed5025c1387bb4e1b
- MD5 SHA1 SHA512
Score

1^/10
behavioral27 behavioral28
- Target
  SOLARAUPDATED/workspace/.tests/readfile.txt
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  SOLARAUPDATED/workspace/.tests/writefile
- Size 7B
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32